CN102255916A - Access authentication method, device, server and system - Google Patents

Abstract

Embodiments of the present invention provide an access authentication method, device, server and system. The method includes: a network access device sends an access authentication request to an access authentication server, the source IP address of the access authentication request includes the EI of the network access device; receiving an authentication response message returned by the access authentication server . The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

Description

Access authentication method, device, server and system

technical field

The embodiments of the present invention relate to the technical field of communication, in particular, an access authentication method, device, server and system.

Background technique

For management and billing requirements, Internet access service providers need to perform authentication and access control on network access devices. The authentication methods are divided into two categories: the first type is to authenticate the physical information of network access devices , such as the MAC address, and then bind the assigned IP address with physical information; the second type is to authenticate the account information of the network access device, and then assign the IP address and bind related information after the authentication is passed. The first type of authentication method is related to the specific access environment. Once the network access device changes the access location, the form of its identity information will change; the second type of authentication method is related to the application layer protocol, and different access networks are different. Different access methods may require network access devices to support different authentication protocols, which will cause network access devices to install different authentication clients, such as PPPoE, 802.1x, etc., and the representation of identity information will also change. When the expression form of the identity information of the network access device changes, the previous authentication will be invalidated, and it is difficult to trace the source of the changed behavior of the network access device.

Therefore, the existing authentication methods all have the problem that it is difficult to trace and audit the network access device due to the change of the expression form of the identity information of the network access device.

Contents of the invention

Embodiments of the present invention provide an access authentication method, device, server, and system, which avoids the problem of difficulty in performing traceability audits on network access devices due to changes in the form of identity information of network access devices existing in existing authentication methods .

On the one hand, an embodiment of the present invention provides an access authentication method, including:

The network access device sends an access authentication request to the access authentication server, and the source IP address of the access authentication request includes the entity identifier EI of the network access device;

Receive an authentication response message returned by the access authentication server.

On the other hand, the embodiment of the present invention also provides an access authentication method, including:

receiving an access authentication request sent by the network access device, where the source IP address of the access authentication request includes the entity identifier EI of the network access device;

Authenticate the network access device according to the EI in the source IP address.

On the other hand, the embodiment of the present invention also provides an access authentication method, including:

Receive a registration message sent by the access authentication server, where the registration message includes the entity identifier EI of the network access device;

generating an access control record containing the EI according to the registration information, and writing the access control record into an access control list to allow the network access device to access the network;

Sending a registration response message to the access authentication server.

On the other hand, an embodiment of the present invention provides a network access device, including:

An authentication request module, configured to send an access authentication request to the access authentication server, where the source IP address of the access authentication request includes the entity identifier EI of the network access device;

The first receiving module is configured to receive an authentication response message returned by the access authentication server.

On the other hand, an embodiment of the present invention provides an access authentication server, including:

The second receiving module is configured to receive an access authentication request sent by the network access device, where the source IP address of the access authentication request includes the entity identifier EI of the network access device;

An authentication module, configured to authenticate the network access device according to the EI in the source IP address.

On the other hand, an embodiment of the present invention provides an access control device, including:

A third receiving module, configured to receive registration information sent by the access authentication server, where the registration information includes the entity identifier EI of the network access device;

An access control module, configured to generate an access control record containing the EI according to the registration information, and write the access control record into an access control list to allow the network access device to access the network;

A third sending module, configured to send a registration response message to the access authentication server.

In yet another aspect, an embodiment of the present invention provides an access authentication system, including: the above-mentioned network access device, access control device, and access authentication server connected in sequence.

The present invention uses the entity identifier EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the network access device The EI contained in the IP address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to perform traceability audit on the network access device due to the change of the expression form of the identity information of the network access device.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will give a brief introduction to the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a schematic flowchart of Embodiment 1 of an access authentication method provided by an embodiment of the present invention.

FIG. 2 is a schematic flowchart of Embodiment 2 of an access authentication method provided by an embodiment of the present invention.

FIG. 3 is a schematic flowchart of Embodiment 3 of an access authentication method provided by an embodiment of the present invention.

FIG. 4 is a schematic flowchart of Embodiment 4 of an access authentication method provided by an embodiment of the present invention.

FIG. 5 is a signaling flowchart of Embodiment 5 of an access authentication method provided by an embodiment of the present invention.

Fig. 6 is a schematic structural diagram of an embodiment of a network access device provided by an embodiment of the present invention.

FIG. 7 is a schematic structural diagram of an embodiment of an access authentication server provided by an embodiment of the present invention.

Fig. 8 is a schematic structural diagram of an embodiment of an access control device provided by an embodiment of the present invention.

FIG. 9 is a schematic structural diagram of an embodiment of an access authentication system provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are the Some, but not all, embodiments are invented. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The main idea of the present invention is to propose an access authentication method oriented to an entity identifier (Entity Identifier, hereinafter referred to as EI) in the IP address of a network access entity. Taking an IPv6 address as an example, an IPv6 address is an address type used by the Internet IPv6 protocol, and its length is 128 bits. According to the regulations of IETF, at most the first 64 bits of an IPv6 address can be used to identify the subnet prefix, which is called the network prefix, and the router selects the forwarding path according to the network prefix. The characteristics of EI include: 1) global uniqueness, EI uniquely identifies the network access entity, and does not change with the change of access location and time; 2) verifiability of EI binding information, EI allocator is responsible for providing Inquiry and verification of identity information on EI. In the embodiment of the present invention, by carrying the EI of the network access entity in the last 64 bits of the IPv6 address, the network access entity using the IP address can be identified based on the IP address. Through the verification of the EI in the IP address, the embodiment of the present invention solves the problem in the existing authentication method that it is difficult to trace the source of the network access entity due to the change of the expression form of the identity information of the network access entity. IP address verification is supported.

FIG. 1 is a schematic flowchart of Embodiment 1 of an access authentication method provided by an embodiment of the present invention. As shown in Figure 1, the method includes:

Step 101, the network access device sends an access authentication request to the access authentication server, and the source IP address of the access authentication request includes the EI of the network access device;

Here, the source IP of the access authentication request is the IP address of the network access device. The EI here can be allocated by the network access device through an out-of-band mechanism before accessing the network. Specifically, the EI can be bound with the identity information of the network access device and/or the user of the network access device during distribution. , which is not limited in this embodiment. In the application, the IP address of the network access device usually includes a subnet prefix. Requesting access parameters such as the subnet prefix is a necessary step for the network access device to access the Internet. Here, the network access device can use route notification or dynamic host A configuration protocol (Dynamic Host Configuration Protocol, DHCP for short) requests to obtain the subnet prefix.

In addition, the network access device can acquire the address of the access authentication server from the broadcast message.

Step 102: Receive an authentication response message returned by the access authentication server.

If the authentication response message indicates that the authentication is passed, the network access device can access the network, and if the authentication response message indicates that the authentication fails, the network access device cannot access the network.

The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

FIG. 2 is a schematic flowchart of Embodiment 2 of an access authentication method provided by an embodiment of the present invention. As shown in Figure 2, the method includes:

Step 201: Receive an access authentication request sent by a network access device, where the source IP address of the access authentication request includes the EI of the network access device;

Step 202, authenticate the network access device according to the EI in the source IP address.

Here, the access authentication server can obtain the authorization information corresponding to the EI from the third-party device that allocates the EI to the network access device. Specifically, how to synchronize the authorization information between the third-party device and the access authentication server, This embodiment is not limited. In the application, if the authentication is passed, the access authentication server can return an authentication response message indicating that the authentication is successful to the network access device, and instruct the access control device to allow the network access device to access the network; The authentication response message indicating authentication failure carries an error code of authentication failure, indicating the reason why the network access device fails to pass the authentication; this embodiment does not limit it.

The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

FIG. 3 is a schematic flowchart of Embodiment 3 of an access authentication method provided by an embodiment of the present invention. As shown in Figure 3, the method includes:

Step 301. Receive a registration message sent by an access authentication server, where the registration message includes the EI of the network access device;

Step 302: Generate an access control record containing the EI according to the registration information, and write the access control record into an access control list to allow the network access device to access the network;

Step 303: Send a registration response message to the access authentication server.

The access control device here is the necessary device for the network access device to access the network. Usually, the access authentication request will also reach the access control device first. After the access control device recognizes that this is an access authentication request The access authentication request will be released and sent to the access authentication server. In the application, if step 302 is successfully executed, the registration response message in step 303 indicates that the registration is successful; if step 302 is not successfully executed, the registration response message in step 303 indicates that the registration failed. Further, the registration response message can also be Feedback error codes for debugging.

The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

FIG. 4 is a schematic flowchart of Embodiment 4 of an access authentication method provided by an embodiment of the present invention. As shown in Figure 4, the method includes:

Step 401, the network access device acquires the allocated EI and the private key corresponding to the EI;

Here the private key is obtained when the EI is distributed.

Step 402, the network access device accesses the network, and acquires a subnet prefix;

Step 403, generating its own IP address according to the subnet prefix and the EI;

Step 404: Generate an access authentication request, sign the access authentication request according to the private key, and send the signed access authentication request to the access authentication server;

Here, the source IP address of the access authentication request is the IP address generated in step 403, that is, the source IP address of the access authentication request includes the EI.

Step 405, the access authentication server obtains authorization information corresponding to the EI in the access authentication request, the authorization information includes the EI and the public key corresponding to the private key;

Step 406, the access authentication server verifies the access authentication request according to the authorization information, if the verification fails, execute step 407, and if the verification passes, execute step 408;

Step 407: Return an authentication response message indicating authentication failure to the network access device, and end.

Step 408: Generate registration information of the network access device, where the registration information includes the EI;

Step 409, sending the registration information to the access control device;

Here, the registration information is used to instruct the access control device to allow the network access device to access the network.

Step 410, the access control device generates an access control record containing the EI according to the registration information, and writes the access control record into an access control list to allow the network access device to access the network;

Step 411, feeding back a registration response message indicating successful registration to the access authentication server;

Step 412: After receiving the registration response message, the access authentication server returns an authentication response message indicating successful authentication to the network access device.

In order to further control the access behavior of the network access device, in addition to the EI, the registration information in step 408 may also include the access validity time, access key, and medium access time of the network access device. Either or both of the control (Media Access Control, MAC) address and port number are included. Correspondingly, when the registration information in step 408 includes access valid time, access key, MAC address or port number, the access control record in step 410 and the authentication response message in step 412 also include access Valid time, access key, MAC address or port number.

In the application, after the access registration is completed, the EI of the network access device has been added to the access control list of the access control device, and the data packet carrying the EI can be routed to the external network through the access control device. In this scenario, it can also include:

The network access device sends a data message, and the source IP address of the data message includes the EI;

The access control device receives the data message, judges whether there is an access control record containing the EI in the access control list, and if so, processes the data message according to the access control record, and if If not, the data packet is discarded.

Of course, if the above steps are executed before step 412, there will be no corresponding access control records, and if after step 412, there will be corresponding access control records.

If the access control record also includes access valid time, access key, MAC address or port number, then processing the data packet according to the access control record includes processing the data packet Further verification. For example, if the access control record contains the access key, since the corresponding authentication response message also contains the access key, in this case, the network access device will After the signature is issued, correspondingly, after the access control device receives the data message, it can verify the signature of the data message according to the access key in the access control record, and after the verification passes, the The data message can be sent out, preferably, the signature can also be removed and the data message with the signature removed can be sent out. Specifically, the access control device may verify the signature of the data message in a keyed-Hash Message Authentication Code (keyed-Hash Message Authentication Code, HMAC for short) manner. If the verification fails, the data packet is discarded. If the access control record contains a MAC address or a port number, after receiving the data message, the access network device can also obtain the source MAC address of the data message or the port number for receiving the data message to Compare and verify with the MAC address or port number in the access control record. If the access control record contains the access valid time, after receiving the data message, the access network device can also judge according to the receiving time, the access valid time in the access control record, and the generation time of the access control record Whether the valid access time of the network access device has expired, if expired, the data packet is discarded, and if not expired, the data packet is released.

The above-mentioned access key is generated by the access authentication server, is an access key shared by the network access device and the access control device, and can improve the security of communication data between the network access device and the access control device. Through the valid access time, the access time of the network access device after one pass of authentication can be controlled, and when the valid access time expires, the network access device needs to request access to the access authentication server again. Specifically, the implementation of re-requesting access includes but is not limited to the following two:

1) If the access registration response message received last time contains the access key, the network access device can use the access key to sign the access authentication request this time, and send the access key containing the signature The incoming authentication request is sent to the access authentication server;

2) Private key signature, that is, use the private key of the EI to sign the access authentication request, and send the access authentication request including the signature to the access authentication server.

After re-requesting the access authentication, the access authority can be updated. For access security, the access authentication server can regenerate the access key, and then report to the access authentication server through the registration information in step 408 and the authentication response message in step 412 respectively. Incoming control equipment and network access equipment distribution.

If the network access device does not resend an access authentication request to the access authentication server before the valid access time expires, and successfully updates the access authority, the access authentication server can also cancel the access of the network access device. and notify the access control device to delete the access control record corresponding to the EI of the network access device from the access control list.

Specifically, the access authentication server may determine whether the network access device has re-authenticated before the valid access time expires, and if not re-authenticated, send the access control device an authorization expiration message containing the EI. message to instruct the access control device to reject the network access device from accessing the network; correspondingly, the access control device receives the permission expiration message sent by the access authentication request, and the permission expiration message includes the EI ; Delete the access control record containing the EI according to the permission expiration message. In this case, the access authentication server actually maintains a database of valid IP addresses in the access network, including the EI part of the IP address, the prefix part of the IP address (access location) and the valid time of the IP address (the access of the EI is valid). time) and other IP address information.

In addition, when the registration information contains the access key, in order to ensure the confidentiality of the access key, the access authentication server in step 408 may also send the registration information containing the access key through a pre-established secure information channel. to the access control device. Correspondingly, in step 412, the access authentication server may also carry the access key in the authentication response message in the form of cipher text and send it to the network access device.

The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device. Furthermore, through the EI registration mechanism, the access control device can not only determine the identity of the network access entity, but also associate each data packet with its sending source, which can effectively prevent the source address of the data packet from being forged.

FIG. 5 is a signaling flowchart of Embodiment 5 of an access authentication method provided by an embodiment of the present invention. As shown, the method includes:

Step 501, the network access device receives the access control information announcement sent by the first-hop router;

The network access device here may be a device such as a host that accesses the network. The access control information notification includes the IP address of the access authentication server.

Step 502, the network access device sends an access authentication request to the access authentication server;

The access authentication request here includes the signature of the EI and private key of the network access device;

Step 503, the access authentication server performs identity verification on the network access device, and selects relevant access parameters;

The access parameters here may include access valid time, access key and so on.

Step 504, the access authentication server registers the network access device with the access control device;

It is equivalent to sending the registration information of the network access device to the access control device, where the registration information includes the EI of the network access device, and optionally also includes the above-mentioned access parameters selected by the access authentication server.

Step 505, the access control device stores the registration information of the network access device;

Step 506, the access control device returns a registration response message to the access authentication server;

Step 507, the access authentication server stores the registration information of the network access device;

Step 508, the access authentication server returns an authentication response message to the network access device.

The authentication response message here includes EI, and optionally also includes access valid time, access key and so on.

The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

Fig. 6 is a schematic structural diagram of an embodiment of a network access device provided by an embodiment of the present invention. As shown in Figure 6, the device includes:

An authentication request module 61, configured to send an access authentication request to the access authentication server, where the source IP address of the access authentication request includes the EI of the network access device;

The first receiving module 62 is configured to receive an authentication response message returned by the access authentication server.

In an optional embodiment of the present invention, the authentication response message returned by the access authentication server includes the access key, then the device further includes:

A signature module 63, configured to use the access key to sign the data message;

The first sending module 64 is configured to send the signed data message.

In yet another optional embodiment of the present invention, the authentication response message returned by the access authentication server includes the valid access time, and the authentication request module 61 is further configured to, if the authentication response message includes the valid access time, Then, before the valid access time expires, resend the access authentication request to the access authentication server.

Applications, the device can also include:

The prefix obtaining module 65 is used to obtain the subnet prefix through routing notification or DHCP request;

An address generating module 66, configured to generate the source IP address according to the subnet prefix and the EI.

In another optional embodiment of the present invention, in order to make the identity verification of the network access device more reliable, the authentication request module 61 is specifically used to:

Obtain the private key of the EI;

Generate the access authentication request, and sign the access authentication request according to the private key.

For the specific implementation of this embodiment, refer to Embodiments 1, 4 or 5 of an access authentication method provided by the embodiments of the present invention. The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

FIG. 7 is a schematic structural diagram of an embodiment of an access authentication server provided by an embodiment of the present invention. As shown in Figure 7, the server includes:

The second receiving module 71 is configured to receive an access authentication request sent by a network access device, where the source IP address of the access authentication request includes the EI of the network access device;

An authentication module 72, configured to authenticate the network access device according to the EI in the source IP address.

In an optional embodiment of the present invention, it also includes:

A registration module 73, configured to generate registration information of the network access device after the authentication is passed, the registration information including the EI;

The second sending module 74 is configured to send the registration message to the access control device, to instruct the access control device to allow the network access device to access the network;

The second receiving module 71 is also configured to receive a registration response message returned by the access control device;

The second sending module 74 is further configured to send an authentication response message to the network access device, where the authentication response message includes the registration message.

Here, the registration response message indicates that the registration is successful, and the authentication response message indicates that the authentication is passed. In addition, if the registration response message indicates registration failure, the authentication response message sent by the second sending module 74 to the network access device indicates authentication failure, and correspondingly does not include the registration information.

In yet another optional embodiment of the present invention, the access authentication request includes a signature of the private key corresponding to the EI to the access authentication request, and the authentication module 72 is specifically used to:

Obtain authorization information corresponding to the EI, where the authorization information includes the EI and a public key corresponding to the private key;

Verifying the access authentication request according to the authorization information.

In another optional embodiment of the present invention, the registration message also includes an access valid time, and the server further includes:

An authority update module 75, configured to determine whether the network access device has re-authenticated before the access valid time expires, and if not re-authenticated, send an authority expiration message containing the EI to the access control device , to instruct the access control device to reject the network access device from accessing the network.

For the specific implementation of this embodiment, refer to Embodiment 2, 4 or 5 of an access authentication method provided by the embodiment of the present invention. The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

Fig. 8 is a schematic structural diagram of an embodiment of an access control device provided by an embodiment of the present invention. As shown in Figure 8, the device includes:

The third receiving module 81 is configured to receive registration information sent by the access authentication server, where the registration information includes the EI of the network access device;

An access control module 82, configured to generate an access control record containing the EI according to the registration information, and write the access control record into an access control list to allow the network access device to access the network;

The third sending module 83 is configured to send a registration response message to the access authentication server.

In an optional embodiment of the present invention, the third receiving module 81 is also configured to receive a data packet sent by the network access device, where the source IP address of the data packet includes the EI;

Correspondingly, the device also includes:

The message processing module 84 is used to find out whether there is an access control record containing the EI in the access control list, if there is, the data message is processed according to the access control record, and if not, the data message is discarded. datagram.

In yet another optional embodiment of the present invention, if the registration information also includes an access key, the access control module 82 is specifically configured to generate an account containing the EI and the access key according to the registration information. access control records;

The message processing module 84 is specifically used to find out whether there is an access control record containing the EI in the access control list, and if so, pair the data message according to the access key in the access control record. Verification is performed, and the data packet is sent out after the verification is passed.

In yet another optional embodiment of the present invention, if the registration information also includes a valid access time, the access control module 82 is specifically configured to generate an account containing the EI and the valid access time according to the registration information. access control records;

The message processing module 84 is specifically configured to judge whether the valid access time has expired, send the data message if it has not expired, and discard the data message if it has expired.

Further, the third receiving module 81 is further configured to receive a permission expiration message including the EI sent by the access authentication server;

The access control module 82 is further configured to delete the access control record including the EI and the valid access time according to the permission expiration message.

In yet another optional embodiment of the present invention, the third receiving module 81 is also configured to receive the access authentication request sent by the network access device;

The third sending module 83 is further configured to send the access authentication request to the authentication server.

For the specific implementation of this embodiment, refer to Embodiment 3, 4 or 5 of an access authentication method provided by the embodiment of the present invention. The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

FIG. 9 is a schematic structural diagram of an embodiment of an access authentication system provided by an embodiment of the present invention. As shown in Figure 9, the system includes: a network access device 91, an access control device 92, and an access authentication server 93 connected in sequence, wherein the network access device 91 is a network access device provided in an embodiment of the present invention. The device described in the embodiment of the access device, the access control device 92 is the device described in the embodiment of the access control device provided in the embodiment of the present invention, and the access authentication server 93 is a device described in the embodiment of the present invention. Access the server described in the authentication server embodiment.

For the specific implementation of this embodiment, refer to Embodiments 1 to 5 of an access authentication method provided by the embodiments of the present invention. The embodiment of the present invention uses the EI that uniquely identifies the identity of the network access device included in the IP address of the network access device to perform authentication and access control on the network access device, so that no matter how the access environment and location change, the IP address of the network access device The EI contained in the address will not change, thereby avoiding the problem in the existing authentication method that it is difficult to trace the source of the network access device due to the change of the expression form of the identity information of the network access device.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (29)

1. An access authentication method, characterized in that, comprising: The network access device sends an access authentication request to the access authentication server, and the source IP address of the access authentication request includes the entity identifier EI of the network access device; Receive an authentication response message returned by the access authentication server. 2. The method according to claim 1, wherein before the network access device sends the access authentication request to the access authentication server, it further includes: Obtain the EI and private key; Generate the access authentication request, and sign the access authentication request according to the private key. 3. The method according to claim 1 or 2, wherein, if the authentication response message includes an access key, after receiving the authentication response message returned by the access authentication server, further comprising: Sign the data message with the access key; Send the signed data message. 4. The method according to claim 1 or 2, wherein, if the authentication response message includes an access valid time, after receiving the authentication response message returned by the access authentication server, the method further includes: Before the valid access time expires, resend the access authentication request to the access authentication server. 5. The method according to claim 1 or 2, wherein the network access device further includes before sending the access authentication request to the access authentication server: Generate the source IP address according to the subnet prefix and the EI. 6. An access authentication method, characterized in that, comprising: receiving an access authentication request sent by the network access device, where the source IP address of the access authentication request includes the entity identifier EI of the network access device; Authenticate the network access device according to the EI in the source IP address. 7. The method according to claim 6, characterized in that, after the authentication is passed, the method further comprises: generating registration information of the network access device, where the registration information includes the EI; sending the registration message to an access control device to instruct the access control device to allow the network access device to access the network; receiving a registration response message returned by the access control device; sending an authentication response message to the network access device, where the authentication response message includes the registration message. 8. The method according to claim 6 or 7, wherein the access authentication request includes a signature of a private key on the access authentication request, and the entity identifier pair in the source IP address The authentication of the network access device specifically includes: Obtain authorization information corresponding to the EI, where the authorization information includes the EI and a public key corresponding to the private key; Verifying the access authentication request according to the authorization information. 9. The method according to claim 7, wherein the registration message includes an access valid time, and after sending the authentication response message to the network access device, it further includes: judging whether the network access device has re-authenticated before the valid access time expires, and if not re-authenticated, sending a permission expiration message containing the entity identifier to the access control device to indicate that the The access control device rejects the network access device from accessing the network. 10. An access authentication method, characterized in that, comprising: Receive a registration message sent by the access authentication server, where the registration message includes the entity identifier EI of the network access device; generating an access control record containing the EI according to the registration information, and writing the access control record into an access control list to allow the network access device to access the network; Sending a registration response message to the access authentication server. 11. The method of claim 10, further comprising: receiving a data message sent by the network access device, where the source IP address of the data message includes the EI; Finding whether there is an access control record containing the EI in the access control list, if yes, processing the data packet according to the access control record, and discarding the data packet if not. 12. The method according to claim 11, wherein if the registration message further includes an access key, the access control record also includes the access key, and the Processing the data message specifically includes: Verifying the data message according to the access key in the access control record, sending the data message if the verification is passed, and discarding the data message if the verification is not passed. 13. The method according to claim 11, wherein if the registration message further includes an access valid time, the access control record also includes the access valid time, and the access control record according to the access control record Processing the data message specifically includes: Judging whether the valid access time has expired, sending the data packet if not expired, and discarding the data packet if expired. 14. The method according to claim 13, further comprising: after sending the registration response message to the access authentication server: receiving a permission expiration message sent by the access authentication request, where the permission expiration message includes the EI; Deleting the access control record including the EI according to the permission expiration message. 15. A network access device, characterized in that it comprises: An authentication request module, configured to send an access authentication request to the access authentication server, where the source IP address of the access authentication request includes the entity identifier EI of the network access device; The first receiving module is configured to receive an authentication response message returned by the access authentication server. 16. The device according to claim 15, wherein the authentication request module is specifically used for: Obtain the EI and private key; Generate the access authentication request, and sign the access authentication request according to the private key. 17. The device according to claim 15 or 16, wherein if the authentication response message includes an access key, it further includes: A signature module, configured to sign the data message with the access key; A first sending module, configured to send the signed data message. 18. The device according to claim 15 or 16, wherein if the authentication response message includes an access valid time, the authentication request module is specifically configured to: Before the valid access time expires, resend the access authentication request to the access authentication server. 19. The device according to claim 15 or 16, further comprising: An address generating module, configured to generate the source IP address according to the subnet prefix and the EI. 20. An access authentication server, characterized in that, comprising: The second receiving module is configured to receive an access authentication request sent by the network access device, where the source IP address of the access authentication request includes the entity identifier EI of the network access device; An authentication module, configured to authenticate the network access device according to the EI in the source IP address. 21. The server according to claim 20, further comprising: A registration module, configured to generate registration information of the network access device after the authentication is passed, the registration information including the EI; A second sending module, configured to send the registration message to an access control device, to instruct the access control device to allow the network access device to access the network; The second receiving module is further configured to receive a registration response message returned by the access control device; The second sending module is further configured to send an authentication response message to the network access device, where the authentication response message includes the registration message. 22. The server according to claim 21 or 22, wherein the access authentication request includes a signature of a private key on the access authentication request, and the authentication module is specifically used for: Obtain authorization information corresponding to the EI, where the authorization information includes the EI and a public key corresponding to the private key; Verifying the access authentication request according to the authorization information. 23. The server according to claim 21, wherein if the registration message includes an access valid time, it further includes: An authority update module, configured to determine whether the network access device has re-authenticated before the access valid time expires, and if not re-authenticated, send an authority expiration message including the EI to the access control device, to instruct the access control device to reject the network access device from accessing the network. 24. An access control device, comprising: A third receiving module, configured to receive registration information sent by the access authentication server, where the registration information includes the entity identifier EI of the network access device; An access control module, configured to generate an access control record containing the EI according to the registration information, and write the access control record into an access control list to allow the network access device to access the network; A third sending module, configured to send a registration response message to the access authentication server. 25. The device according to claim 24, wherein the third receiving module is further configured to receive a data message sent by the network access device, the source IP address of the data message includes the EI; Also includes: The message processing module is used to find out whether there is an access control record containing the EI in the access control list, if there is, the data message is processed according to the access control record, and if not, the data is discarded message. 26. The device according to claim 25, wherein if the registration information further includes an access key, then The access control module is specifically configured to generate an access control record containing the EI and the access key according to the registration information; The message processing module is specifically configured to verify the data message according to the access key in the access control record, send the data message if the verification passes, and discard the data message if the verification fails The datagram. 27. The device according to claim 25, wherein if the registration information also includes an access valid time, then The access control module is specifically configured to generate an access control record including the EI and the valid access time according to the registration information; The message processing module is specifically configured to judge whether the access valid time has expired, and if not expired, send the data message, and if expired, discard the data message. 28. The device according to claim 27, wherein the third receiving module is further configured to receive a permission expiration message including the EI sent by the access authentication server; The access control module is further configured to delete the access control record containing the EI according to the permission expiration message. 29. An access authentication system, characterized by comprising: the network access device according to any one of claims 15-19, the access control device according to any one of claims 24-28, and The access authentication server according to any one of claims 20-23.

Images